<html>
<head><meta charset="utf-8"><title>panic during drop · t-compiler/wg-mir-opt · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/index.html">t-compiler/wg-mir-opt</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html">panic during drop</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="210620344"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210620344" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Charles Lew <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210620344">(Sep 19 2020 at 15:23)</a>:</h4>
<p>may i ask small question about mir... i see this code generated:<br>
<code>drop(_2) -&gt; [return: bb4, unwind: bb5];</code> but i thought <code>dropping</code> cannot panic?</p>



<a name="210620418"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210620418" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210620418">(Sep 19 2020 at 15:25)</a>:</h4>
<p>dropping can definitely panic, though usually doing so is bad practice because if your panicking drop gets run as part of unwinding, it'll abort</p>



<a name="210620471"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210620471" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210620471">(Sep 19 2020 at 15:27)</a>:</h4>
<p>ISTR a proposal to make panic always abort in drop</p>



<a name="210620482"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210620482" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Charles Lew <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210620482">(Sep 19 2020 at 15:27)</a>:</h4>
<p>oh, ok, thanks!</p>



<a name="210621538"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210621538" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210621538">(Sep 19 2020 at 15:51)</a>:</h4>
<p>yes, there's indeed such a proposal, but it is unclear how we'd roll it out and how to warn about the potential breakage. iirc one idea was to do it across an edition boundary, but it's unclear if that actually works well</p>



<a name="210635516"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210635516" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210635516">(Sep 19 2020 at 21:11)</a>:</h4>
<p>Yeah, that seems awkward since the <code>Drop</code> implementation you're calling could have been written in a different edition.  So I guess it'd be "drops that throw abort the program if that drop impl was compiled using edition vNNNN?"  Seems difficult to rely on.</p>



<a name="210635627"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210635627" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210635627">(Sep 19 2020 at 21:14)</a>:</h4>
<p><span class="user-mention" data-user-id="125270">@scottmcm</span> yeah it's not the <em>best</em>, but I think if the theory is that no one is relying on this <em>now</em> but we aren't 100% confident in that, something like this could work</p>



<a name="210635641"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210635641" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210635641">(Sep 19 2020 at 21:15)</a>:</h4>
<p>that said, I think the primary benefit of such a rule is the avoidance of code that tries to be intelligent about continuing to drop after panics in drop</p>



<a name="210635647"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210635647" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210635647">(Sep 19 2020 at 21:15)</a>:</h4>
<p>so maybe this is not super helpful in that sense</p>



<a name="210635878"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210635878" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210635878">(Sep 19 2020 at 21:20)</a>:</h4>
<p>I guess another option would be a different panic strategy, to make it global.  And changing panic strategy can already break dependencies, so...</p>



<a name="210636067"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210636067" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Samuel Harrington <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210636067">(Sep 19 2020 at 21:25)</a>:</h4>
<p>Servo definitely does intentionally panic during drop, if not already panicking:<br>
<a href="https://github.com/servo/servo/blob/4eefaa4a2c664e93f6f3cc18ad28b957b8200616/components/layout_2020/context.rs#L46">https://github.com/servo/servo/blob/4eefaa4a2c664e93f6f3cc18ad28b957b8200616/components/layout_2020/context.rs#L46</a></p>



<a name="210636144"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210636144" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Samuel Harrington <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210636144">(Sep 19 2020 at 21:26)</a>:</h4>
<p>I have no opinion on whether that's a good idea, though :)</p>



<a name="210636551"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210636551" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210636551">(Sep 19 2020 at 21:37)</a>:</h4>
<p>Hm, interesting. The question I guess is whether that panic leading to an abort would be a problem for servo. I guess presumably yes...</p>



<a name="210662219"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210662219" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210662219">(Sep 20 2020 at 11:24)</a>:</h4>
<p><span class="user-mention silent" data-user-id="116122">simulacrum</span> <a href="#narrow/stream/189540-t-compiler.2Fwg-mir-opt/topic/panic.20during.20drop/near/210636551">said</a>:</p>
<blockquote>
<p>Hm, interesting. The question I guess is whether that panic leading to an abort would be a problem for servo. I guess presumably yes...</p>
</blockquote>
<p>presumably that is why they only assert if things are not already panicking -- to avoid the double-panic abort.</p>



<a name="210662229"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210662229" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210662229">(Sep 20 2020 at 11:24)</a>:</h4>
<p><span class="user-mention" data-user-id="219747">@Simon Sapin</span> ^</p>



<a name="210662567"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210662567" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Simon Sapin <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210662567">(Sep 20 2020 at 11:33)</a>:</h4>
<p>Yes, the branch for already panicking is to avoid the double-panic abort. Asserting in destructors to check invariants and catch bugs is useful. The proposal to make all panics in destructors abort would prevent that. What’s the benefit of that proposal?</p>



<a name="210667760"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210667760" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210667760">(Sep 20 2020 at 13:46)</a>:</h4>
<p>hm, not sure if there's a good summary somewhere... basically, it is really hard to make (unsafe) code handle that situation correctly</p>



<a name="210667780"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210667780" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210667780">(Sep 20 2020 at 13:46)</a>:</h4>
<p>for unsafe code it is often very important to know if an operation can panic or not, and it is extremely easy to forget that every assignment or end of scope can implicitly cause panics if there are user-defined types being dropped there</p>



<a name="210667785"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210667785" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210667785">(Sep 20 2020 at 13:46)</a>:</h4>
<p>IIRC even the standard library has bugs in that area semi-regularly</p>



<a name="210667793"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210667793" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210667793">(Sep 20 2020 at 13:47)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span> will probably know more</p>



<a name="210669831"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210669831" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Simon Sapin <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210669831">(Sep 20 2020 at 14:43)</a>:</h4>
<p>Yeah, I remember that panic-safety can be surprisingly tricky when writing generic unsafe code. Removing unwinding from destructors seems like a big hammer for only slightly improving that situation, though.</p>



<a name="210671578"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210671578" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210671578">(Sep 20 2020 at 15:29)</a>:</h4>
<p>I think there's that, but IIRC most of the discussions came about as a result of a series of patches trying to make the standard library drop more in the presence of panics in panics</p>
<p>e.g. if you drop a vector, and dropping the 3rd element panics, currently we'll go on and try to drop the rest of the elements still</p>



<a name="210671625"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210671625" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210671625">(Sep 20 2020 at 15:30)</a>:</h4>
<p>but that's more code and is (potentially) not great code-size wise etc</p>
<p>if we just aborted in dtor panics, then that wouldn't be necessary</p>



<a name="210671630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210671630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210671630">(Sep 20 2020 at 15:30)</a>:</h4>
<p>of course, the alternative is to just say "that's not necessary" :)</p>



<a name="210672778"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210672778" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Simon Sapin <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210672778">(Sep 20 2020 at 16:03)</a>:</h4>
<p>By that same logic if we never unwind and all panics are aborts, then we don’t need to worry about leaking the rest of a Vec’s items when dropping one of them panics.</p>



<a name="210672787"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210672787" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Simon Sapin <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210672787">(Sep 20 2020 at 16:03)</a>:</h4>
<p>We already have a compiler flag for opting into that behavior</p>



<a name="210672955"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210672955" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Simon Sapin <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210672955">(Sep 20 2020 at 16:07)</a>:</h4>
<p><span class="user-mention" data-user-id="116122">@simulacrum</span> Looking more closely, the logic of "leaking the rest of the items is bad, let’s nuke the whole process instead" makes no sense to me</p>



<a name="210673034"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210673034" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210673034">(Sep 20 2020 at 16:09)</a>:</h4>
<p>Yeah, I don't think that it's a matter of being more logical to nuke the process -- it's more of a "no one needs to think about this" I guess. I agree it's not super well-motivated, so it's not too surprising that nothing has happened here yet</p>



<a name="210673119"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210673119" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Simon Sapin <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210673119">(Sep 20 2020 at 16:10)</a>:</h4>
<p>For the Vec case, leaking seems like a fine way to not think about this to me</p>



<a name="210673139"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210673139" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210673139">(Sep 20 2020 at 16:11)</a>:</h4>
<p>For <code>Vec&lt;Box&lt;dyn Trait&gt;&gt;</code> leaking the rest of the items would cause a memory leak. This is harder to debug than aborting the process.</p>



<a name="210674029"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210674029" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Simon Sapin <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210674029">(Sep 20 2020 at 16:33)</a>:</h4>
<p>Same leak like as <code>Vec&lt;AnythingThatOwnsHeapAllocations&gt;</code>, right?</p>



<a name="210674033"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210674033" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210674033">(Sep 20 2020 at 16:33)</a>:</h4>
<p><span class="user-mention" data-user-id="125270">@scottmcm</span> The idea of making it a different panic strategy makes sense. That would make it more difficult to deprecate the strategy that allows panics during drop, but it would allow a smooth transition.</p>



<a name="210674124"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210674124" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210674124">(Sep 20 2020 at 16:36)</a>:</h4>
<p>And yes, there have absolutely been bugs in this area.</p>



<a name="210674223"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210674223" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210674223">(Sep 20 2020 at 16:38)</a>:</h4>
<p><span class="user-mention" data-user-id="219747">@Simon Sapin</span> Why would making panics in destructors abort mean that you can't use assert to check important conditions inside destructors? The assertion would still take place, and would still catch potential bugs. A panic that aborts still prints a message before it does.</p>



<a name="210674230"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210674230" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210674230">(Sep 20 2020 at 16:38)</a>:</h4>
<p>It just doesn't unwind.</p>



<a name="210674923"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210674923" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Simon Sapin <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210674923">(Sep 20 2020 at 16:57)</a>:</h4>
<p>Ok, that’s true. Still, I don’t get why this half-way strategy between panic=unwind and panic=abort is desirable</p>



<a name="210675806"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210675806" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210675806">(Sep 20 2020 at 17:19)</a>:</h4>
<p>It would avoid all the extra code required, and developer awareness required, for a potential unwind from a destructor.</p>



<a name="210675856"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210675856" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210675856">(Sep 20 2020 at 17:20)</a>:</h4>
<p>In other words, it would reduce very likely bugs.</p>



<a name="210675882"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210675882" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210675882">(Sep 20 2020 at 17:20)</a>:</h4>
<p>Writing "unwind safe" code is a source of bugs, for very minimal apparent value.</p>



<a name="210709277"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210709277" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210709277">(Sep 21 2020 at 07:36)</a>:</h4>
<p>a "half-way" panic strategy wouldn't really help for collections that want to avoid leaks though, they'd still need that code</p>



<a name="210709340"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210709340" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210709340">(Sep 21 2020 at 07:37)</a>:</h4>
<p>what would help is to establish "it's okay for collections to abort-on-panic-in-drop", add a little helper <code>abort_on_unwind</code> (a wrapper around <code>catch_unwind</code>), and use that in collections' <code>drop</code> impl</p>



<a name="210710603"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210710603" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210710603">(Sep 21 2020 at 07:55)</a>:</h4>
<p>Setting that as a libs expectation makes sense to me.</p>
<p>Prior Art: C++'s <code>Container</code> requires the element is <a href="https://en.cppreference.com/w/cpp/named_req/Destructible"><code>Destructible</code></a> which requires that the destructor doesn't throw, so "we abort if you panic in a destructor for an item in a vec" seems like a reasonable translation of that requirement to safe rust.</p>



<a name="210732834"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210732834" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Simon Sapin <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210732834">(Sep 21 2020 at 12:21)</a>:</h4>
<p>Yes unwind-safety in generic unsafe code is very tricky but destructors are only part of it</p>



<a name="210736164"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210736164" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210736164">(Sep 21 2020 at 12:53)</a>:</h4>
<p>There is a precedent: in C++11, destructors were switched to be marked <code>noexcept</code> by default which casues them to abort if they throw an exception. You can still opt-in to allowing a destructor to throw by marking it <code>noexcept(false)</code>.</p>



<a name="210736358"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/189540-t-compiler/wg-mir-opt/topic/panic%20during%20drop/near/210736358" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/189540-t-compiler/wg-mir-opt/topic/panic.20during.20drop.html#210736358">(Sep 21 2020 at 12:54)</a>:</h4>
<p>Also note that in C++ you get undefined behavior if the destructor of an object in a standard collection (eg. <code>std::vector</code>) throws.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>